runatlantis has 3 CVEs on record. 3 were published in the last 90 days. The median CVSS is 8.1 (high). Most affected products: github.com/runatlantis/atlantis (2), atlantis (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 8.1
- Publish → KEV
- —
- Last 90 days
- 3 prev 0
Products
- github.com/runatlantis/atlantis 2
- atlantis 1
Worst active — by depth score
CVE-2026-116676High· 8.8Atlantis: OS command injection through PR-controlled Terraform workspace enables RCE during plan48CVE-2026-64679High· 8.1Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks45CVE-2026-82282High· 8.0Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials44
runatlantis vulnerabilities
CVEs affecting runatlantis, newest first. Open any entry for full detail, references, and exploit status.
3 CVEsRSS
CVE-2026-116676High· 8.8Atlantis: OS command injection through PR-controlled Terraform workspace enables RCE during plan
Atlantis: OS command injection through PR-controlled Terraform workspace enables RCE during plan
CVE-2026-82282High· 8.0Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials
Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA priv…
CVE-2026-64679High· 8.1Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks
Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From 0.19.8 until 0.45.0, Atlantis does not consistently validate user-controlled workspace values supplied through accepted reposi…